1. Technical Field
The present invention relates generally to an improved data processing system, and in particular, to a method and apparatus for processing data. Still more particularly, the present invention provides a method and apparatus for preventing security exploits associated with buffer overflows.
2. Description of Related Art
Computers and networks are commonplace tools for many companies and businesses. Networks are used internally by a company to share information and conduct business. Often times, many types of applications and programs will be used within a network or a computer. Some of these applications and programs may be commercial packages while others may be customized for the particular client. These systems are often subject to attack or exploitation by unauthorized users.
For example, a hacker may attempt to gain unauthorized access to a computer system by trying to obtain a user ID and password that allows access to privileged objects within a system. Another area of concern involves security problems arising from coding errors that occur when a data buffer is allocated and data is copied into that buffer in a manner that the data “overflows” the end of the allocated storage. These types of overflows may allow an unauthorized or unprivileged subject to execute or access privileged objects in a computer or in a network.
For example, a command line argument may be added to a print command. If a buffer overflow is caused by the command line argument, a user may be able to print files that are normally unprintable by the particular user.
Another example of such a vulnerability is in Windows XP, which is an operating system available from Microsoft Corporation. With respect to universal plug and play (UPnP), an unchecked buffer is present in one of the components that handles NOTIFY directives, which are messages that advertise the availability of UPnP-capable devices on the network. By sending a specially-malformed NOTIFY directive, it would be possible for an attacker to cause code to run in the context of the UPnP service, which runs with system privileges on Windows XP. This situation would enable the attacker to gain complete control over the computer.
When these types of security holes or exploits are identified, programs may be patched to prevent future exploits. However, such a solution does not prevent buffer overflow exploits for programs and functions in which the bugs in coding that may allow unanticipated access remain unidentified.
Therefore, it would be advantageous to have an improved method, apparatus, and computer instructions for preventing security exploits based on buffer overruns.